# EasyIO controllers: disable cleartext management and install the firmware correction Canonical: https://www.oktsec.com/radar/johnson-controls-easyio-cve-2026-106018 Publisher: Oktsec Language: en Published: 2026-11-14T14:23:10Z Updated: 2026-11-14T14:23:10Z Record reviewed: 2026-11-14T14:23:10Z Latest evidence check: 2026-11-14T14:23:10Z Disclosed: 2026-11-12 Johnson Controls identifies exposure of credentials and session data through cleartext management traffic in EasyIO FW. Firmware V3.0b26 disables HTTP by default; the reviewed advisory does not report attacks. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The vendor provides a firmware correction for cleartext information exposure in building controllers. Exploitation is not established; deployment requires operational and safety planning. - Evidence: No attacks reported - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Johnson Controls - Products: EasyIO FW - CVEs: CVE-2026-106018 ## Technical overview EasyIO FW controls building functions such as HVAC, lighting and energy systems. The vendor’s November 12 advisory identifies firmware through V3.0b25 as affected and dates the corrected V3.0b26 release to September 30. The disclosure date is not the date the correction first became available. The temporary measures reduce exposure while an operationally safe update is arranged. A version check alone should not replace verification of the actual management protocol and access controls. The advisory does not establish a victim count or an ongoing attack campaign. ## Recommended response Plan the V3.0b26 or later update with operations. Enforce HTTPS, disable HTTP and restrict management access; verify those settings after upgrading. Relevant to: Facilities and OT teams operating EasyIO building controllers. ## CVE attribution - CVE-2026-106018: Johnson Controls — EasyIO FW. [Source](https://tyco.widen.net/content/pqzxmca3wx/original/JCI-PSA-2026-42.pdf?u=zsfbap&download=true) ## Affected systems and fixes ### EasyIO FW building automation controllers Affected: Firmware V3.0b25 and earlier; the reported exposure involves sensitive management traffic sent without encryption. Fixed release / action: V3.0b26 or later; HTTP disabled by default Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.13 Checked: 2026-11-14T16:03:56.845Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-106018](https://api.first.org/data/v1/epss?cve=CVE-2026-106018): 0.26% probability of observed exploitation in the next 30 days; percentile 17.72%; score date 2026-11-14. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z. ## Response checklist 1. **Identify affected controllers** — Record firmware versions and whether management traffic still uses HTTP. 2. **Coordinate the firmware update** — Obtain V3.0b26 or later through the vendor. Back up configuration, assess operational impact and test before production deployment where feasible. 3. **Verify encrypted management access** — Enforce HTTPS and disable HTTP. Limit access to trusted management hosts, segment the controllers and use a VPN for remote administration. 4. **Review management traffic** — Check unexpected console access, configuration changes and evidence of credentials or session tokens crossing the network without encryption. ## Relevance to AI environments Check how automated management systems reach the controller and handle its credentials. ## Sources - [JCI-PSA-2026-42: scope, firmware fix and mitigations](https://tyco.widen.net/content/pqzxmca3wx/original/JCI-PSA-2026-42.pdf?u=zsfbap&download=true) — Johnson Controls; Vendor notice; checked 2026-11-14T14:23:10Z - [AV26-1158: affected EasyIO firmware](https://www.cyber.gc.ca/en/alerts-advisories/control-systems-johnson-controls-security-advisory-av26-1158) — Canadian Centre for Cyber Security; Government advisory; checked 2026-11-14T14:23:10Z ## Editorial record - 2026-11-14T14:23:10Z: Added the vendor’s exact firmware correction, release date and operational precautions. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/johnson-controls-easyio-cve-2026-106018) · [Build a response plan](https://www.oktsec.com/radar/johnson-controls-easyio-cve-2026-106018#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=johnson-controls-easyio-cve-2026-106018&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=johnson-controls-easyio-cve-2026-106018&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.